Hacker News Reader

Dropping packets with IP options from XDP should be a more complete mitigation (also more performant).

tl;dr: eBPF programs that run hot off the DMA buffers, before skbufs are created, that can XDP_DROP packets.

In some cases on the NIC itself! (i'm sure you know this)